carlos / platform Public

provision: root-read census overlay for generation sockets (census ruling zddr4, #272)

Adds the zddr4 overlay, loaded after hotfix281 in TestPlan14RootReadCensus
and in a new TestPlan14Zddr4OverlayPreservesLegacySeal. Fourteen units
are accepted-legacy under rev3=census-ruling-zddr4, each with a one-line
basis and the ruling's boundary: agent-side, running as carlos;
generation socket directories under the agent's own /run/carlos tree; no
root decision; no registry, /data, release or claim read beyond what the
unit read before.

- Ten changed rows: startGenFrom, GenPaths, StartStaged, genTerminated,
  handlelessGenEmpty, failedWakeStopped, prepareAt, swapOverlap,
  foreignRow, holdAdmitLocked. Each adds only more reads of fields it
  already read (Host, Socket) or passes the same Route.
- Four new rows: ExecBackend.GenLayout, SplitBackend.GenLayout,
  removeGenDir, Service.swapLayout.
- Refreshed envelopes: cmd/zddprobe, internal/activator.

Legacy seal re-pinned beside the zddr4 load:
e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d
(hotfix281's 6da50872... plus exactly fourteen declarations).

Caller check (STOP clause): a VTA call graph over the whole binary from
the root-run entry points (host.RunAdopt, host.RunInstanceControl,
runSystem), following a closure only once its enclosing function is
reached. RunAdopt and runSystem reach none of the fourteen units.
RunInstanceControl's only paths run through (*edge.Edge).ServeHTTP into
(*activator.Service) methods, and neither edge.New nor activator.New, the
only places those receivers are made, is reachable from any root entry
point; instance-control's server serves its own /claim mux. guard-exec
reaches the agent only by exec, into carlos-edge.service (User=carlos).

rev3=census-ruling-zddr4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 59f6080c24a4f34b9afae431ddf5a194687eafcf parent 8d93e49

3 files changed, +112 −0

internal/provision/plan14_legacy_identity_test.go +69 −0
internal/provision/plan14_root_reads_test.go +10 −0
internal/provision/testdata/plan14-root-reads-zddr4.tsv +33 −0

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	336.125s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.009s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.214s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.703s
ok  	github.com/carlosframework/platform/internal/activator	233.189s
ok  	github.com/carlosframework/platform/internal/agentsock	0.015s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.018s
ok  	github.com/carlosframework/platform/internal/appconfig	2.307s
ok  	github.com/carlosframework/platform/internal/apperr	0.069s
ok  	github.com/carlosframework/platform/internal/applog	0.125s
ok  	github.com/carlosframework/platform/internal/awsinv	0.006s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.005s
ok  	github.com/carlosframework/platform/internal/boxid	0.821s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.014s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.699s
ok  	github.com/carlosframework/platform/internal/changelog	0.300s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	362.181s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.240s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.008s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.002s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.090s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.003s
ok  	github.com/carlosframework/platform/internal/edge	26.103s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.007s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.119s
ok  	github.com/carlosframework/platform/internal/gate	1.654s
ok  	github.com/carlosframework/platform/internal/genselect	0.014s
ok  	github.com/carlosframework/platform/internal/geo	0.018s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/host	125.974s
ok  	github.com/carlosframework/platform/internal/hostactors	0.304s
ok  	github.com/carlosframework/platform/internal/hostbox	2.297s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.504s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.014s
ok  	github.com/carlosframework/platform/internal/hostexec	4.864s
ok  	github.com/carlosframework/platform/internal/hostfence	0.033s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.545s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.014s
ok  	github.com/carlosframework/platform/internal/hostguard	0.969s
ok  	github.com/carlosframework/platform/internal/hostops	1.399s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.014s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.014s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.426s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.135s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.014s
ok  	github.com/carlosframework/platform/internal/infraview	0.014s
ok  	github.com/carlosframework/platform/internal/instancectl	1.825s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.711s
ok  	github.com/carlosframework/platform/internal/instancefs	0.015s
ok  	github.com/carlosframework/platform/internal/instancekey	0.016s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.019s
ok  	github.com/carlosframework/platform/internal/layout	1.409s
ok  	github.com/carlosframework/platform/internal/lease	9.454s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.006s
ok  	github.com/carlosframework/platform/internal/ledger	0.011s
ok  	github.com/carlosframework/platform/internal/mail	0.160s
ok  	github.com/carlosframework/platform/internal/maintenance	0.081s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.477s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.074s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	20.966s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.740s
ok  	github.com/carlosframework/platform/internal/objstore	0.157s
ok  	github.com/carlosframework/platform/internal/ops	0.161s
ok  	github.com/carlosframework/platform/internal/park	0.212s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	11.643s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.006s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	4.018s
ok  	github.com/carlosframework/platform/internal/relay	7.223s
ok  	github.com/carlosframework/platform/internal/release	19.762s
ok  	github.com/carlosframework/platform/internal/rollout	3.609s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.007s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/s3compat	0.004s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.258s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	8.946s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.109s
ok  	github.com/carlosframework/platform/internal/status	0.044s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.191s
ok  	github.com/carlosframework/platform/internal/svcrole	0.003s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.003s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.563s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.021s
=== RUN   TestT4StorageProbeMinio
2026/10/13 23:24:17 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DE3A59697D78E0, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.020s
minio contract: PASS

Intent

full ledger: zdd-gen-socket-names

diff --git a/internal/provision/plan14_legacy_identity_test.go b/internal/provision/plan14_legacy_identity_test.go

index c0d52099d..532c38815 100644

--- a/internal/provision/plan14_legacy_identity_test.go

+++ b/internal/provision/plan14_legacy_identity_test.go

@@ -248,3 +248,72 @@ func TestPlan14Zddr3OverlayPreservesLegacySeal(t *testing.T) {

t.Fatal("unapproved legacy fingerprint accepted")

}

+// Census ruling zddr4 (zero-downtime deploys rev 19, Gate F, #272): the

+// generation socket overlay, loaded after hotfix281.

+func TestPlan14Zddr4OverlayPreservesLegacySeal(t *testing.T) {

+ root := censusRoot(t)

+ inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}

+ for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv"} {

+ if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {

+ t.Fatal(err)

+ }

+ if errs := checkRootReadLegacy(inv, "6da50872e15f7f396d23e5b1b2e044a73cd9e5c07d85c8e22252b0a1a5304bbd"); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ original := make(map[string]bool, len(inv.Legacy))

+ for hash := range inv.Legacy {

+ original[hash] = true

+ }

+ if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-zddr4.tsv", &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ for hash := range original {

+ if !inv.Legacy[hash] {

+ t.Fatalf("zddr4 removed original freeze %s", hash)

+ }

+ if len(inv.Legacy) != len(original)+14 {

+ t.Fatal("census ruling zddr4 permits exactly fourteen new frozen declarations")

+ }

+ // Census ruling zddr4 seal: ten changed activator rows (startGenFrom,

+ // GenPaths, StartStaged, genTerminated, handlelessGenEmpty,

+ // failedWakeStopped, prepareAt, swapOverlap, foreignRow,

+ // holdAdmitLocked) plus four new ones (ExecBackend.GenLayout,

+ // SplitBackend.GenLayout, removeGenDir, swapLayout).

+ const seal = "e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d"

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ units := []string{

+ "internal/activator/backend_exec.go:ExecBackend.startGenFrom",

+ "internal/activator/genbackend.go:ExecBackend.GenPaths",

+ "internal/activator/genbackend.go:ExecBackend.StartStaged",

+ "internal/activator/opset.go:Service.genTerminated",

+ "internal/activator/opset.go:Service.handlelessGenEmpty",

+ "internal/activator/opset.go:Service.failedWakeStopped",

+ "internal/activator/prepare.go:ExecBackend.prepareAt",

+ "internal/activator/swap.go:Service.swapOverlap",

+ "internal/activator/swaphold.go:Service.foreignRow",

+ "internal/activator/swaphold.go:Service.holdAdmitLocked",

+ "internal/activator/genbackend.go:ExecBackend.GenLayout",

+ "internal/activator/genbackend.go:SplitBackend.GenLayout",

+ "internal/activator/generations.go:removeGenDir",

+ "internal/activator/swaphold.go:Service.swapLayout",

+ }

+ const boundary = "Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before."

+ for _, key := range units {

+ e, ok := inv.Entries[key]

+ if !ok || e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-zddr4;") || !strings.HasSuffix(e.Basis, boundary) {

+ t.Fatalf("wrong zddr4 disposition for %s: %+v", key, e)

+ }

+ if f, ok := inv.Frozen[key]; !ok || rootReadLegacyFingerprint(f) != rootReadLegacyFingerprint(e) {

+ t.Fatalf("%s is not frozen as classified", key)

+ }

+ inv.Legacy[strings.Repeat("0", 64)] = true

+ if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {

+ t.Fatal("unapproved legacy fingerprint accepted")

+ }

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 0033203f3..fe8dbe6b7 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -658,6 +658,16 @@ func TestPlan14RootReadCensus(t *testing.T) {

t.Fatal(err)

}

seal = "6da50872e15f7f396d23e5b1b2e044a73cd9e5c07d85c8e22252b0a1a5304bbd"

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-zddr4.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ // Census ruling zddr4 (zero-downtime rev 19, Gate F, #272): ten changed

+ // activator rows and four new ones (generation socket directories) add

+ // fourteen frozen declarations.

+ seal = "e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-zddr4.tsv b/internal/provision/testdata/plan14-root-reads-zddr4.tsv

new file mode 100644

index 000000000..88aca72bc

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-zddr4.tsv

@@ -0,0 +1,33 @@

+# Plan 14 census ruling zddr4 (zero-downtime deploys rev 19 amendment, Gate F, amadan #272): generation sockets keep the flag-off file name in a directory of their own. The changed and new activator units are accepted legacy because they stay agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before.

+# An over-long flat host counted as foreign for generation decisions is an agent-side deny and fits that boundary. If any of these units ever runs as root or reads outside that boundary it stops being legacy and needs the Plan 14 owner's ruling. Earlier overlays are immutable.

+@legacy dc698b892747c4be0ec17b83d180edf2da154c92fc224abc3ab391666db7ef9f internal/activator/backend_exec.go ExecBackend.startGenFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the generation socket path is chosen through genLayout on the same row's Host, an over-long flat host is logged and keeps its canonical socket as a foreign row does, and the leftover canonical link is cleared for any spawn on the canonical socket. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@1084,registry:Host@1709,registry:Host@1871,registry:Host@380,registry:Host@436,registry:Host@685,registry:Socket@1126,registry:Socket@1615,registry:Socket@1745,registry:Socket@328,whole:Route@1933,whole:Route@315,whole:Route@960 9d1788ec9700865c6046e1c466b1e06e654d00e605d2b35297cc192bc731861c

+internal/activator/backend_exec.go ExecBackend.startGenFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the generation socket path is chosen through genLayout on the same row's Host, an over-long flat host is logged and keeps its canonical socket as a foreign row does, and the leftover canonical link is cleared for any spawn on the canonical socket. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@1084,registry:Host@1709,registry:Host@1871,registry:Host@380,registry:Host@436,registry:Host@685,registry:Socket@1126,registry:Socket@1615,registry:Socket@1745,registry:Socket@328,whole:Route@1933,whole:Route@315,whole:Route@960 9d1788ec9700865c6046e1c466b1e06e654d00e605d2b35297cc192bc731861c

+@legacy 795ff1d9aa340c52bd2b08601cb090c9e318c93eee0b7eaa70d0996f1541ed51 internal/activator/genbackend.go ExecBackend.GenPaths legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same Classify layout is passed through genLayout on the same row's Host, so an over-long flat host has no generation path, as a foreign row has none. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@140,registry:Host@194,whole:Route@91 34d63dd48fd86a2e3d4ea4bf7d7022bb5e39eab9e820b8a1df12887fd0ccc2f4

+internal/activator/genbackend.go ExecBackend.GenPaths legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same Classify layout is passed through genLayout on the same row's Host, so an over-long flat host has no generation path, as a foreign row has none. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@140,registry:Host@194,whole:Route@91 34d63dd48fd86a2e3d4ea4bf7d7022bb5e39eab9e820b8a1df12887fd0ccc2f4

+@legacy 36678d5f13f63fa11f515dd04da937963c16f589701aee2829ac1e1aa39dc722 internal/activator/genbackend.go ExecBackend.StartStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same layout switch goes through genLayout on the same row's Host, so an over-long flat host takes the existing foreign arm on its canonical socket. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@1701,registry:Host@221,registry:Host@276,registry:Host@398,registry:Host@898,registry:Socket@1067,registry:Socket@1078,registry:Socket@809,registry:Socket@960,whole:Route@1467,whole:Route@156,whole:Route@189,whole:Route@456,whole:Route@956 2561db67e458818736964d27fe18b2b16027f6b4ed523bc23f9bf99c2700ad18

+internal/activator/genbackend.go ExecBackend.StartStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same layout switch goes through genLayout on the same row's Host, so an over-long flat host takes the existing foreign arm on its canonical socket. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@1701,registry:Host@221,registry:Host@276,registry:Host@398,registry:Host@898,registry:Socket@1067,registry:Socket@1078,registry:Socket@809,registry:Socket@960,whole:Route@1467,whole:Route@156,whole:Route@189,whole:Route@456,whole:Route@956 2561db67e458818736964d27fe18b2b16027f6b4ed523bc23f9bf99c2700ad18

+@legacy 03bddaccf2f9196bf5f3d9ebeb9f2c1ae27721d52ed43cadf7754ec0247e82f4 internal/activator/opset.go Service.genTerminated legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged termination proof holds, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@266,whole:Route@368,whole:Route@435 ce408258825ac8650517a004d9d1868912c0b3ab9920f04c132060a5564bd496

+internal/activator/opset.go Service.genTerminated legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged termination proof holds, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@266,whole:Route@368,whole:Route@435 ce408258825ac8650517a004d9d1868912c0b3ab9920f04c132060a5564bd496

+@legacy df0ed90064b7ae08e98bf26cae8752828d8cf2525b1d5acf9ffb99fd89bbbe5f internal/activator/opset.go Service.handlelessGenEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged KillGen proof holds, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@123,whole:Route@181 9ab9046c4eaa787968a51629564812a11f9b16f79d6b2ed48e1b6259127d0f82

+internal/activator/opset.go Service.handlelessGenEmpty legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged KillGen proof holds, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@123,whole:Route@181 9ab9046c4eaa787968a51629564812a11f9b16f79d6b2ed48e1b6259127d0f82

+@legacy 3f25557f06cf9a8d84cb79f405766afdb355108faeca9337ae953563d43368b3 internal/activator/opset.go Service.failedWakeStopped legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged proof holds, the host-cgroup proof included where it is needed, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@266,whole:Route@514,whole:Route@622,whole:Route@959 ce0575660e2528b04edb7d69de3fb8cda9761182431629b6a591e63d153ee433

+internal/activator/opset.go Service.failedWakeStopped legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; after the unchanged proof holds, the host-cgroup proof included where it is needed, removeGenDir removes the generation's own empty socket directory. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@266,whole:Route@514,whole:Route@622,whole:Route@959 ce0575660e2528b04edb7d69de3fb8cda9761182431629b6a591e63d153ee433

+@legacy 364c06e030c985f9071eb6240813c5a26915e83e2fbf3154a49a92cb7299df0c internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; a generation socket's own g<n> directory inside the instance run dir is made, 0750 setgid, before the unchanged stale-file removal. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:ReadDir@1842,registry:Host@1035,registry:Host@1280,registry:Host@4027,registry:Host@4188,registry:Host@443,registry:Host@940,whole:Route@1113,whole:Route@1356,whole:Route@197,whole:Route@3532,whole:Route@3871,whole:Route@4061 87013e6a3295e78f1ca06f34698dedf87a548ac211d5d9099e1f876e9df5bfb4

+internal/activator/prepare.go ExecBackend.prepareAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; a generation socket's own g<n> directory inside the instance run dir is made, 0750 setgid, before the unchanged stale-file removal. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:ReadDir@1842,registry:Host@1035,registry:Host@1280,registry:Host@4027,registry:Host@4188,registry:Host@443,registry:Host@940,whole:Route@1113,whole:Route@1356,whole:Route@197,whole:Route@3532,whole:Route@3871,whole:Route@4061 87013e6a3295e78f1ca06f34698dedf87a548ac211d5d9099e1f876e9df5bfb4

+@legacy 4bd1a38bcae29e6b5861d4ce33e54cf8b00f7ab94383f84f293d104117f72293 internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the overlap admission's layout check reads the same entry route through swapLayout instead of Classifier.Layout, so an over-long flat host is refused as a foreign row is (an agent-side deny). Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Kind@1902,whole:Route@1904,whole:Route@2228,whole:Route@2631,whole:Route@2649,whole:Route@3244,whole:Route@3292,whole:Route@3807,whole:Route@5291,whole:Route@7681,whole:Route@9215,whole:Route@9222,whole:Route@9262 b4f0c2b27d9b66bd4ce34f0bb36d41ab663be4b3bf0818eecdb9f4b9705a8c42

+internal/activator/swap.go Service.swapOverlap legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the overlap admission's layout check reads the same entry route through swapLayout instead of Classifier.Layout, so an over-long flat host is refused as a foreign row is (an agent-side deny). Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Kind@1902,whole:Route@1904,whole:Route@2228,whole:Route@2631,whole:Route@2649,whole:Route@3244,whole:Route@3292,whole:Route@3807,whole:Route@5291,whole:Route@7681,whole:Route@9215,whole:Route@9222,whole:Route@9262 b4f0c2b27d9b66bd4ce34f0bb36d41ab663be4b3bf0818eecdb9f4b9705a8c42

+@legacy 034d3f17d51fdc2f6eba5388983c25029ec69362530807afb04183298bc7ebbe internal/activator/swaphold.go Service.foreignRow legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same entry route is read through swapLayout instead of Classifier.Layout, so an over-long flat host counts as foreign and its overlap runs as a hold (an agent-side deny). Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@124,whole:Route@131,whole:Route@211 202e99f9b25f5d72b055610ce6c5702115a192bc5e3eb8dccf2ae13ec2ec6782

+internal/activator/swaphold.go Service.foreignRow legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same entry route is read through swapLayout instead of Classifier.Layout, so an over-long flat host counts as foreign and its overlap runs as a hold (an agent-side deny). Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@124,whole:Route@131,whole:Route@211 202e99f9b25f5d72b055610ce6c5702115a192bc5e3eb8dccf2ae13ec2ec6782

+@legacy 74cc7260b1589d9ce1008dff776047452059a23b491d59b78b8085a939f7d529 internal/activator/swaphold.go Service.holdAdmitLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same entry route's layout is read through swapLayout instead of Classifier.Layout; the accepted layouts are unchanged. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Backing@216,registry:Kind@186,whole:Route@188,whole:Route@218,whole:Route@454 d799942b4dd82aff68e3cd893a5454b4064cccabc8c223cd00b01cce8c94c27f

+internal/activator/swaphold.go Service.holdAdmitLocked legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: changed legacy row; the same entry route's layout is read through swapLayout instead of Classifier.Layout; the accepted layouts are unchanged. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Backing@216,registry:Kind@186,whole:Route@188,whole:Route@218,whole:Route@454 d799942b4dd82aff68e3cd893a5454b4064cccabc8c223cd00b01cce8c94c27f

+@legacy 0ad95a7feaff196ab33517d84c7093216e99a50cd8949139784c733bf063a1b7 internal/activator/genbackend.go ExecBackend.GenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; ExecBackend.Layout of the row passed through genLayout on its Host, a pure length check on a path under /run/carlos. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@103,whole:Route@78 006f4773612ecc5331b82dcb68d2d7ccae12ef1ebf112c4969bacab1286b64ae

+internal/activator/genbackend.go ExecBackend.GenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; ExecBackend.Layout of the row passed through genLayout on its Host, a pure length check on a path under /run/carlos. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. registry:Host@103,whole:Route@78 006f4773612ecc5331b82dcb68d2d7ccae12ef1ebf112c4969bacab1286b64ae

+@legacy e13b5ef5bb44d76fc8461aa39deb429642ebd786b0a59201f0525f3e22472a88 internal/activator/genbackend.go SplitBackend.GenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; forwards an exec row to the exec half's GenLayout and reads a unit row's Backing as SplitBackend.Layout already does. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:Exec@116,registry:Backing@65,whole:Route@165,whole:Route@194 446df7024a611a62293f8a296b51631ab90251874b7e475daf0c3912b21dc624

+internal/activator/genbackend.go SplitBackend.GenLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; forwards an exec row to the exec half's GenLayout and reads a unit row's Backing as SplitBackend.Layout already does. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:Exec@116,registry:Backing@65,whole:Route@165,whole:Route@194 446df7024a611a62293f8a296b51631ab90251874b7e475daf0c3912b21dc624

+@legacy 5ecb1a3f92c17838124aa0f6e4e33e63d02c07e0e875ad23c4d786b75e014411 internal/activator/generations.go removeGenDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; reads the agent's own generation socket directory (ReadDir) to remove it only when empty, and the row's Host only for a log line; only a directory named for the generation's number that holds its socket is a candidate. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:ReadDir@254,registry:Host@470,whole:Route@78 f61d1d2caab7cf3b16428a7f052b1b8266135532569a8a239415e66f75f1a459

+internal/activator/generations.go removeGenDir legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; reads the agent's own generation socket directory (ReadDir) to remove it only when empty, and the row's Host only for a log line; only a directory named for the generation's number that holds its socket is a candidate. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. file:ReadDir@254,registry:Host@470,whole:Route@78 f61d1d2caab7cf3b16428a7f052b1b8266135532569a8a239415e66f75f1a459

+@legacy f4db0317506a91218701894b9343de98ba491519066006172485f45cd6fff4ba internal/activator/swaphold.go Service.swapLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; passes an entry route to the backend's GenLayout, else to its Classifier.Layout, as the callers did before. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@129,whole:Route@203 a18de2da8d0bfa931af0ff6d65f1095abadf5271ef753eba385aba3aab2d3c46

+internal/activator/swaphold.go Service.swapLayout legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr4;basis=Census ruling zddr4: new unit; passes an entry route to the backend's GenLayout, else to its Classifier.Layout, as the callers did before. Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before. whole:Route@129,whole:Route@203 a18de2da8d0bfa931af0ff6d65f1095abadf5271ef753eba385aba3aab2d3c46

+# Envelopes, census ruling zddr4: each changed root source envelope below is accepted only because the units inside it are the ones listed above; boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree.

+@coverage cmd/zddprobe 7caf15d5b0663091108482a70ed71d1970eff947b0fe1860e560dd3822f0e675

+@coverage internal/activator 000f17d496e5791e7404952f0f4236a7cb3b02306042e3dc03149369a2878cf7